Amendments to the Specification: 

Please replace the paragraph beginning on page 10, line 10 with the following amended 
paragraph: 

FIG. 1 depicts one example of a trusted public key certificate system 100 that employs at 
least one signed certificate set in accordance with one embodiment of the invention. The system 
100 includes a number of certificate issuing units 102a-102n such as certification authorities, for 
issuing public key certificates, attribute certificates or any other suitable certificates or data 
structures. The system 100 also includes a plurality of signed certificate set generators 104a- 
104n, each associated with a respective certificate issuing unit 102a-102n, and a plurality of 
message receiving units, such as client units 106a-106n. In this example, certificate issuing unit 
102a is the anchor certificate issuing unit for client units 106a and 106b. Similarly, the 
certificate issuing unit 102c is the anchor certificate issuing unit for client units 106c and 106d, 
and certificate issuing unit 102n is an anchor certificate issuing unit for client unit 106n 
(additional or fewer). Certificate issuing units and client units may also be included in the 
system, but are not shown. In this example, the client units 106a-106n may be, for example, but 
are not limited to, executing software applications, or any suitable processing unit that contains, 
for example, a cryptographic engine that can vahdate certificates or otherwise send encrypted 
messages to other client units in the system. 

Please replace the paragraph beginning on page 1 1 , line 4 with the following amended 
paragraph: 

Each signed certificate set generator 104a-104n, may be a server or, for example, [[a]]an 
executing software application, discrete logic, a plurality of processing units, or any other 
suitable structure that is operative to collect a plurality of cross certificates associated with at 
least one anchor certificate issuing unit that is operative to obtain all certificate issuing unit 
certificates for all of the cross certified certificate issuing units identified by the cross 
certificates' interest. The signed certificate set generators 104a-104n are operative to create a 
signed certificate set (SCS) identifying certificate issuing units determined to be trusted by the 
anchor certificate issuing unit, based on the cross certificates, wherein the signed certificate set 
includes at least a unique identifier, such as a distinguished name (DN), and a public key for 
each trusted certificate issuing unit that has been determined to meet certain trust criteria. As 
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used herein, the public key of each trusted certificate issuing unit includes any index to such 
public keys to provide, for example, an indirect link (e.g. a DN of the trusted certificate issuing 
unit and a key identifier of the public key, along with a secure hash of the public key)^ 



CHICAGO/# 1620688.1 



3 



